                                          :user_data user_data
                                          :lifecycle { :create_before_destroy true }
                                          :key_name (get spec :key_name "ops-terraboot")
-                                         :security_groups (map #(id-of "aws_security_group" %) sgs)
+                                         :security_groups security-groups
                                          :associate_public_ip_address (or public_ip false)
                                          :root_block_device root_block_device}
 

                                (assoc map :ebs_block_device ebs_block_device)
                                map))
        root_block_device (get spec :root_block_device {})
        asg-config
        (merge-in
         (resource "aws_iam_instance_profile" name

         rule])))))

(defn aws-instance [name spec]
  (let [default-sg-ids (map (partial id-of "aws_security_group") default-sgs)]
    (resource "aws_instance" name (-> {:tags {:Name name}
                                       :instance_type "t2.micro"
                                       :key_name "ops-terraboot"
